Webhooks

{
  "id": "evt_sig_abc",
  "event": "signal.created",
  "workspaceId": "org_...",
  "createdAt": "2026-09-03T10:00:00.000Z",
  "data": { ... }
}

import { createHmac, timingSafeEqual } from "node:crypto";

function isValidOpenPulseSignature(
  rawBody: string,
  signatureHeader: string,
  signingSecret: string,
): boolean {
  const expected = createHmac("sha256", signingSecret)
    .update(rawBody)
    .digest("hex");

  const a = Buffer.from(expected, "utf8");
  const b = Buffer.from(signatureHeader, "utf8");
  return a.length === b.length && timingSafeEqual(a, b);
}